2015 STEWARDSHIP REPORT - University of Cincinnati€¦ · 2015 STEWARDSHIP REPORT Issue Date: March 2016 To learn more, visit: uc.edu/gencounsel/rmi Department of Enterprise Risk

1ERM Stewardship Report

2015 STEWARDSHIP REPORT

Issue Date: March 2016To learn more, visit: uc.edu/gencounsel/rmi

Department of Enterprise Risk Management

http://uc.edu/gencounsel/rmi


We would like to offer special thanks to the following individuals for their guidance over the inaugural year of the Enterprise Risk Management program.

Audit & Risk Management Committee of the Board of Trustees:

Ronald D. Brown, Chair Thomas D. Cassady, Vice Chair Geraldine B. Warner

ERM Executive Committee:

Santa Ono, PresidentRobert AmbachWilliam BallMike BohnBeverly DavenportRobin EngelKenya FaulknerRod GrabowskiRyan HaysPatrick LimbachBleuzette MarshallDebra MerchantGreg VehrNelson Vincent

Risk Council:

Christine AckermanTodd BeekleyAmanda BillTamie GrunowTracy HerrmannLarry JohnsonPatrick KowalskiChris LindsellMaggie MckinleyRaj MehtaRichard MillerKathy QuallsM.B. ReillyDenine RoccoKaz ScrivensJane StrasserCady Short ThompsonJan Arthur UtrechtBo VykhovanyukRick Wiggins


UC6

721

Table of Contents

Table of Contents 1

A Message from the Chief Risk Officer 2

Overview - Mission/Strategies/Organization 3

Insurance Program 6

Metrics 11

Enterprise Risk Management 16

Loss Control 19

A Look Ahead 20

Contact Us 22


A MESSAGE FROM THE CHIEF RISK OFFICER Anita Ingram, Assistant Vice President and Chief Risk Officer

2015 was a year of change for the University of Cincinnati’s Department of Risk Management. We began the year by filling key vacancies for the position of Associate Director of Risk Management and Senior Claims’ Analyst. The year ended by hiring an Enterprise Risk Management (ERM) Communications Coordi-nator, who will help support the chief risk officer in the continued development of the university’s newly launched Enterprise Risk Management program. With a renewed focus following our mid-year business strategic planning retreat, the Department of Risk Management, organized under the Office of General Counsel, realigned our mission and defined our business objectives to more closely align with the univer-sity’s “Creating Our Third Century” strategic plan. Lastly, to reflect our new strategic direction, we changed our department’s name from “Risk Management” to “Enterprise Risk Management.”

Enterprise Risk Management (ERM), an internationally established best practice for identifying organiza-tional risk in the corporate sector, is quickly becoming the standard in institutions of higher education. ERM helps decentralized institutions form a common language to identify, evaluate and mitigate risks while enhancing opportunities (the upside of risk) capable of affecting the mission of the enterprise. The ERM process empowers identified risk owners with the ability to manage risks while providing reasonable assurance of achieving organizational objectives.

Starting in FY13, under the guidance of the University of Cincinnati’s Director of Internal Audit and Senior Vice President of Administration & Finance, Huron Consulting undertook a detailed assessment and review of the university’s risk management and compliance programs. Huron recommended that the university adopt the discipline of Enterprise Risk Management and hire a chief risk officer to implement and lead the program. With the agreement of the President and the Board, a nationwide search was launched for a chief risk officer. In October 2014, the University of Cincinnati hired its first chief risk officer to champion its ERM program. Our ERM program started with the establishment of a governance structure that includes accountability and oversight of ERM activities by members of a Risk Council, who are appointed by the President, and an ERM Executive Committee made up of key senior leadership. Demonstrating the en-gagement of top leadership, the ERM program includes a dotted line reporting role to both the President and the Audit & Risk Management Committee of the Board of Trustees.

Through the identification of top risks and more recent purchase of conceptual and analytical software, we are proud to note that the university’s ERM program has established a foundation to begin coordinating strategic alignments and integrations across the entire university. Additional details of our program are provided in this report.

This stewardship report highlights a few of the many exciting changes the Department of Enterprise Risk Management has effected since its inception and notes some of the activities and results included in the more traditional measures of risk management. We aspire to be the best-practice leader for higher educa-tion risk management. Thank you for taking the time to read this publication and further familiarize your-self with the Department of Enterprise Risk Management. We welcome your feedback and look forward to working with you in the year ahead.


OVERVIEW

MissionIn cooperation and collaboration with our stakeholders, the Department of Enterprise Risk Management will help ensure the future viability of the University of Cincinnati by developing a risk-aware culture across our institution. Through proactive consultation and assessment of risk, we will enable the university to evaluate, balance and embrace appropriate risks and opportunities across the enterprise.

ObjectivesThe Department of Enterprise Risk Management has four key goals:

1. Advance the discipline of Enterprise Risk Management 2. Increase internal efficiencies and maximize value3. Enhance partnership with UC Health & UC Physicians (“UCP”)* 4. Fully integrate Department of Enterprise Risk Management within the Office of General Counsel (“OGC”)

*Risk Management activities involving UC Health are defined by a shared services agreement between the University of Cincinnati and UC Health (see UC Health and UC Physicians Claims Management).

Strategies/Goals• Implement Riskonnect, an integrated Risk Management Information System (“RMIS”)• Increase use of technology through the use of office productivity tools• Improve internal collaboration and communication with key stakeholders• Establish risk baseline metrics and ongoing risk assessment process with key stakeholders• Execute an ERM communication strategy• Improve effectiveness and efficiency of processes (standardization/automation/eliminate duplication)• Demonstrate value of Department of Enterprise Risk Management services to UCP and UC Health• Enhance coordination with the Office of General Counsel (“OGC”)• Improve department efficiencies and communication via the co-location to shared office space

Metrics• Implement new Risk Management Information System by summer 2016• Develop and deploy RMIS training by winter 2016 • Develop a statement of risk appetite by spring 2016• Deliver 1000 training man hours by winter 2016• Develop and offer five stakeholder trainings by winter 2016• Create and distribute Faculty/Staff 911 Guide by spring 2016• Create and distribute ERM Stewardship Reports for UC, UCMC, and UCP by spring 2016• Co-locate with General Counsel (East Office) in University Hall by summer 2016 • Implement record retention Document Management System by spring 2016• Obtain baseline metric for timely resolution of claims by winter 2016• Resolve Medical Professional Liability claims within self-insured retention• Develop and issue quarterly reports for UC, UC Health, and UCP within 30 days of end of quarter • Complete insurance applications and submissions within 45 days of renewal• Identify and initiate three collaborative projects with OGC by winter 2016• Measure and control university total cost of risk (“TCOR”)• Measure office efficiency (response to inquiries within 24 hours, return phone calls, email, etc.)


ORGANIZATION

Anita Ingram is Assistant Vice President & Chief Risk Officer at University of Cincin-nati, overseeing the Department of Enterprise Risk Management since 2014. Previ-ous to this, Anita was Chief Risk Officer at Southern Methodist University, responsible for oversight of the Office of Risk Management and security for the George Bush Presidential Center. She was Assistant Risk Manager at Chemed, a Fortune 500 com-pany located in Cincinnati, from ‘93-‘97.

Anita was President of the University Risk Management & Insurance Association (“URMIA”) in 2014 and served on their executive board from 2007-2015. The Risk Management Society (“RIMS”) Dallas-Fort Worth chapter recognized her among the “Top 8 Risk Management Professionals in the Region-2012” and Business Insurance magazine named her among the 2014 “Top 25 Women to Watch.”

Kathleen (Kaz) Scrivens is the Director for the University of Cincinnati’s Department of Enterprise Risk Management. She is an attorney admitted to practice in Ohio, and a registered nurse. Kaz moved into the role of Director in April, 2014 after serving as Associate Director for 17 years and Assistant Director for six years.

Todd Beekley is Associate Director of Enterprise Risk Management. Todd man-ages and oversees litigation relating to University of Cincinnati Medical Center and is responsible for advising physicians, administrators and staff on medical legal and risk management issues. Todd also oversees the university’s self-insured and insured claims. He also is active in loss control efforts and consults on insurance questions across the university. Most recently, Todd worked for the Board of County Commissioners of Hamilton County, Ohio in risk management, where he managed the workers’ compensation insurance program and served as interim risk manager. He is an attorney admitted to practice in Ohio, Missouri and Illinois and his experience includes successful first-chair jury and bench trial experience in workers’ compensation, premises liability, and general liability cases.


Jean Miller has been employed at University of Cincinnati’s Department of Enter-prise Risk Management for the past 26 years. Jean has worked for 23 years as the Insurance Analyst, after serving as the Claims Analyst for three years. She currently maintains UC’s property/casualty insurance programs and assists in the insurance purchases. She is responsible for management of departmental operations and the administration of insurance underwriting, which requires coordination between many internal and external stakeholders. In addition, she currently serves on the Inter-University Council Insurance Consortium (“IUC-IC”) Underwriting Committee.

Warren Meilicke is Senior Claims Analyst at University of Cincinnati. Warren investigates and resolves university property, casualty and automobile claims in the Department of Enterprise Risk Management. He performs work on behalf of University of Cincinnati Medical Center, providing management and oversight of high dollar property claims and patient property claims. Warren also assists with the development and support of university loss control programs. Previously, Warren was a Claims Professional at Travelers Insurance, handling first-party and commer-cial property claims of varying complexity in the Greater Cincinnati area and within the continental United States during catastrophic weather events. In addition, he currently serves on the Inter-University Council Insurance Consortium (“IUC-IC”) Loss Control Committee.

Amanda Bill is the Communications Coordinator for the Department of Enterprise Risk Management. This is a new role designed to raise awareness about risk management across the university. Prior to coming to UC in September 2015, Amanda spent eight years at Procter & Gamble in the Legal and Quality Assurance organizations.

Valencia Williams is a temporary contracted Project Manager at University of Cincinnati, overseeing the implementation of Riskonnect, the new Risk Management Information System (RMIS).

Previously, Valencia was Business Manager at Children’s Hospital, where she had a consistent track record of success in the management of business critical projects. She developed SharePoint tracking tools for personnel records, inventory of divi-sional assets, outstanding invoices, space planning, etc. She also developed and implemented new hire orientation sessions that resulted in 97 percent compliance and reduced operational costs of remote staff by 80 percent without reduction of staff or resources.


INSURANCE PROGRAM State of the Insurance Market and Renewal Accomplishments The insurance market threatened to tighten in 2014-15 and many insurance buyers experienced the first notable increase in rates, terms and conditions in several years. However, UC’s property rates remained flat, due in part to favorable negotiations by UC’s insurance broker and the Inter-University Council-Insurance Consortium (IUC-IC- UC’s insurance risk pool group) with the property carrier. At the suggestion of the UC chief risk officer, the negotiations included an agreement to undertake a property evaluation appraisal process in lieu of another automatic inflationary increase in the property program. Building appraisals were last performed at UC in 1986. We received a dividend from United Educators, UC’s excess insurance provider. This helped to offset a modest increase in the excess liability rates. We also accomplished the following for the 2015-16 insurance renewal:

• Saved $85,000 in risk transfer premium costs under the property program by negotiating out the inflationary increase. (Note: if building & content values had been inflated this would have cost the IUC-IC $85,000. This premium savings was fully offset by the purchase of building & content appraisal services.) The appraisal work began in November and will continue for two years under similar terms and conditions.

• Maintained excess liability coverage at total shared aggregate limits with other IUC-IC schools at $50 million.

• Obtained coverage for Unmanned Aircraft Systems (UAS)/Model Aircraft at no additional cost.

• Recognized increasing threats to privacy data in higher education through the purchase of a new $5 million per occurrence Cyber Liability and Breach Response policy, underwritten by Beazley, a Lloyd’s syndicate.

• Added new Pollution Liability coverage with AIG through the IUC-IC program. Limits are $5 million each occurrence/$10 million aggregate, for a three-year term, subject to a $25,000 per occurrence deductible. Coverage includes legal liability and on-site clean-up of unknown pollutants.

• Obtained quotes and placed coverage for the university owned/managed summer camps through K&K Insurance. Coverage provides $1 million General Liability insurance, includes sexual molestation and abuse coverage, and provides $25,000 in medical payments.

• Remained essentially flat on renewal of all other lines of insurance coverage.

• Workers compensation claims and premiums are managed by UC Human Resources and are included in the Total Cost of Risk portion of this report.


$100

Mill

ion

$50

Mill

ion

$25

Mill

ion

$10

Mill

ion

$5 M

illio

n

$1 M

illio

n

$350

,000

$100

,000

Lexi

ngto

n In

sura

nce

Co.

Lim

it $1

00 M

illio

n/oc

curr

ence

Prem

ium

: $79

8,79

7

End

uran

ceLi

mit

$25

Mill

ion

xs $

25 M

illio

nPr

emiu

m: $

34,4

53(S

hare

d A

ggre

gate

with

IUC-

IC S

choo

ls)

Uni

ted

Edu

cato

rs

Sha

red

Exc

ess

Lim

it $1

5 M

illio

n xs

of

$10

Mill

ion

Prem

ium

: $79

,707

Gen

eral

Rei

nsur

ance

Cor

por

atio

nLi

mit

$10

Mill

ion/

occu

rren

cePr

emiu

m: $

164,

726

Uni

ted

Edu

cato

rs

Sha

red

Exc

ess

Lim

it $1

5 M

illio

n xs

of

$10

Mill

ion

Prem

ium

: $38

,411

IUC

-IC

Poo

lLi

mit

$250

,000

IUC

-IC

Poo

lLi

mit

$900

,000

/occ

urre

nce

Prem

ium

: $89

,186

Bea

zley

1

Lim

it $5

Mill

ion/

occu

rren

cePr

emiu

m: $

116,

668

Ded

uctib

le:

$100

,000

$350

dep

artm

enta

l ded

uctib

le

Prop

erty

(incl

. Boi

ler &

Mac

hine

ry)

Gen

eral

Lia

bilit

yA

uto

Educ

ator

’s Le

gal L

iabi

lity

Cybe

r

Ded

uctib

le:

$100

,000

Rete

ntio

n:$1

00,0

00$1

,000

phy

sica

l dam

age

dedu

ctib

le

Rete

ntio

n:$1

00,0

00Re

tent

ion:

$100

,000

com

bine

d

Figu

re 1

: Ins

uran

ce C

over

age

Det

ails

FY1

5 (J

uly

1, 2

014–

June

30,

201

5)

Oth

er a

ncill

ary

cove

rage

s:

Pre

miu

m:

Arli

tt H

ead

Star

t and

Chi

ld D

evel

opm

ent

$650

A

lum

ni A

ssoc

iatio

n G

L, N

on-o

wne

d Au

to, a

nd C

omm

erci

al P

rope

rty

$1,7

50

Exec

utiv

e N

on-O

wne

d A

ircra

ft2

$13,

600

Non

-Ow

ned

Airc

raft

Flig

ht S

choo

l (Cl

erm

ont)

3

$8,1

50

Fide

lity

(em

ploy

ee d

isho

nest

y) C

rime

$20,

079

Fore

ign

liabi

lity

$8

,314

Sp

ecia

l Acc

iden

t Ter

m 7

/1/1

3-16

$1

,369

IS

OS

Emer

genc

y Tr

avel

Ass

ista

nce

Serv

ices

$10,

149

US

Post

al B

ond

$4

50

Und

ergr

ound

Sto

rage

Tan

ks

$4,0

00

Wat

er w

orks

bon

ds (2

)

$200

U

C po

rtio

n of

med

ical

pro

fess

iona

l lia

bilit

y pr

emiu

m4

$5

1,41

4

Tota

l FY

16 In

sura

nce

Pre

miu

ms

$

1,6

02

,89

0

1new

cyb

er p

olic

y ef

fect

ive

3/1/

14 th

roug

h 7/

1/16

2 exe

cutiv

e po

licy

effe

ctiv

e 4/

10/1

4 th

roug

h 4/

10/1

5

3flig

ht s

choo

l pol

icy

effe

ctiv

e 12

/1/1

4 th

roug

h12/

1/15

4ful

l det

ails

of M

edic

al P

rofe

ssio

nal L

iabi

lity

depi

cted

in s

epar

ate

char

t


Figu

re 2

: Ins

uran

ce C

over

age

Det

ails

FY1

6 (J

uly

1, 2

015–

June

30,

201

6)

Oth

er a

ncill

ary

cove

rage

s:

Pre

miu

m:

Arli

tt H

ead

Star

t and

Chi

ld D

evel

opm

ent

$750

A

lum

ni A

ssoc

iatio

n G

L, N

on-o

wne

d Au

to, a

nd C

omm

erci

al P

rope

rty

$1,9

65

Exec

utiv

e N

on-O

wne

d A

ircra

ft3

$11,

500

Non

-Ow

ned

Airc

raft

Flig

ht S

choo

l (Cl

erm

ont)

4

$8,1

50

Fide

lity

(em

ploy

ee d

isho

nest

y) C

rime

$19,

691

Fore

ign

liabi

lity

$9

,613

Sp

ecia

l Acc

iden

t Ter

m 7

/1/1

3-16

$1

,369

IS

OS

Emer

genc

y Tr

avel

Ass

ista

nce

Serv

ices

$10,

981

US

Post

al B

ond

$4

50

Und

ergr

ound

Sto

rage

Tan

ks

$3,2

00

Wat

er w

orks

bon

ds (2

)

$200

Ca

mp-

even

ts c

over

ages

5

$10,

688

UC

port

ion

of m

edic

al p

rofe

ssio

nal l

iabi

lity

prem

ium

6

$48,

454

Tota

l FY

16 In

sura

nce

Pre

miu

ms

$

1,4

90

,519

1cyb

er p

rem

ium

was

pai

d at

pol

icy

effec

tive

date

(3/1

/14)

for t

he 1

5-16

pol

icy

perio

d

2pol

lutio

n po

licy

effec

tive

7/1/

15 th

roug

h 6/

30/1

8 3e

xecu

tive

non-

owne

d ai

rcra

ft p

olic

y eff

ectiv

e 4/

10/1

5 th

roug

h 4/

10/1

6 4fl

ight

sch

ool n

on-o

wne

d ai

rcra

ft p

olic

y eff

ectiv

e 12

/1/1

5 th

roug

h12/

1/16

5v

ario

us c

amp

cove

rage

s in

cl. a

thle

tics,

CCM

, etc

. 6f

ull d

etai

ls o

f Med

ical

Pro

fess

iona

l Lia

bilit

y de

pict

ed in

sep

arat

e ch

art

$100

Mill

ion

$50

Mill

ion

$25

Mill

ion

$10

Mill

ion

$5 M

illio

n

$1 M

illio

n

$350

,000

$100

,000

Lexi

ngto

n In

sura

nce

Co.

Lim

it $1

00 M

illio

n/oc

curr

ence

Prem

ium

: $79

3,40

1

End

uran

ceLi

mit

$25

Mill

ion

xs $

25 M

illio

nPr

emiu

m: $

35,2

65(S

hare

d A

ggre

gate

with

IUC-

IC S

choo

ls)

Uni

ted

Edu

cato

rs

Sha

red

Exc

ess

Lim

it $1

5 M

illio

n xs

of

$10

Mill

ion

Prem

ium

: $82

,616

Gen

eral

Rei

nsur

ance

Cor

por

atio

nLi

mit

$10

Mill

ion/

occu

rren

cePr

emiu

m: $

164,

021

Uni

ted

Edu

cato

rs

Sha

red

Exc

ess

Lim

it $1

5 M

illio

n xs

of

$10

Mill

ion

Prem

ium

: $39

,812

IUC

-IC

Poo

lLi

mit

$250

,000

IUC

-IC

Poo

lLi

mit

$900

,000

/occ

urre

nce

Prem

ium

: $74

,187

Bea

zley

1

Lim

it $5

Mill

ion/

occu

rren

cePr

emiu

m: $

116,

668

AIG

Sp

ecia

lty

Ins.

Co.

Lim

it $5

Mill

ion/

occu

rren

cePr

emiu

m: $

13,1

22

Ded

uctib

le:

$1,0

00$3

50 d

epar

tmen

tal d

educ

tible

Prop

erty

(incl

. Boi

ler &

Mac

hine

ry)

Gen

eral

Lia

bilit

yA

uto

Educ

ator

’s Le

gal L

iabi

lity

Cybe

rPo

lluti

on2

Ded

uctib

le:

$100

,000

Rete

ntio

n:$1

00,0

00$1

,000

phy

sica

l dam

age

dedu

ctib

le

Rete

ntio

n:$1

00,0

00Re

tent

ion:

$100

,000

com

bine

dRe

tent

ion:

$25

,000

$25,

000


MEDICAL PROFESSIONAL LIABILITY UC’s Department of Enterprise Risk Management provides risk management services for UC Physicians (“UCP”) and contracted risk management services for the University of Cincinnati Medical Center, a subsidiary of UC Health. Primary medical malpractice coverage is provided through a self-insurance program.

For FY16, after applying a 50% credit for good loss performance, the professional liability calculated premium was $1.92M. Of that amount, approximately 92% was allocated to UCP and the remainder was allocated to the university for coverage of Hoxworth and other medical professional programs. This compares favorably to FY15 primary insurance premium of $3.19M, which included only a 25% credit. Overall, FY16 primary premium decreased $1.27M, or 39.8%.

UC HEALTH AND UC PHYSICIANS CLAIMS MANAGEMENTIn support of the educational mission of the university and more specifically the College of Medicine, faculty physicians engage in clinical or other professional activities. Along with the benefits these activities represent in terms of the university’s mission, such as the educational and research opportunities, patient care/community service and faculty development, these activities also carry the risk of third-party liability. The UC Department of Enterprise Risk Management provides medical professional liability risk management and legal services to the College of Medicine and to UC Physicians, Inc. (i.e. faculty member physician practice plan groups). By contract and agreement with UC Health,

we also supply risk management services for the University of Cincinnati Medical Center, where UC’s faculty physicians educate future members of the medical community.

Both University of Cincinnati and UC Health each maintain self-insurance programs for professional (medical malpractice) and general liability. In our role, we provide underwriting support, legal and claims management, and risk management services and expertise to UC Health. Because of the successful handling of professional liability claims, the self-insurance fund has grown and actuarial confidence in the insurance program has increased.

In FY15, the Department:

• Met with various departments and committees, including Emergency Medicine and Internal Medicine, to consider loss control efforts.

• Counseled physicians, nurses and others on medical legal issues.

• Verified coverage, provided quarterly claim reports and claims history letters for the hospital and current and former hospital employees, including present and former residents.

• Updated physician rosters and coordinated and issued monthly billing and review services for UCP practice plans.

• Worked closely with University of Cincinnati Medical Center on patient safety issues.

• Participated as members of various UC Health and UCP committees and teams, including the UCP Risk & Compliance Committee of the UCP Board and UC Health Patient Relations Committee.

• Reviewed clinical trials insurance policy.

• Managed the investigation, review and disposition of UCMC property claims >$500,000, and all patient property claims.

• Managed all medical professional liability claims for UC Health and/or UCP (see Figure 3).


Figure 3: Disposition of UCP and/or UC Health claims

37%

27% 3%

33%

Medical Professional Liability# of claims and disposition (as of July 1, 2015)

closed with no payment

settled within self-insured retention

trial verdict in UCP favor

pending

11 10

1

8


METRICS WHAT IS THE TOTAL COST OF RISKA goal of senior administrators is to manage costs, and one type of cost to be managed is the “total cost of risk.” Managing total cost of risk (“TCOR”), however, cannot be done unless and until those costs are carefully identified and measured.

In considering total cost of risk, the first issue to be addressed is the term itself. “Total” is something of a misnomer. Many factors at an institution of higher education contribute to its cost of risk; some of these factors are more easily quantified than others. Although it may be difficult or even impossible for an institution to capture its total cost of risk, any attempt to measure cost of risk will be a valuable step in managing those risks. By identifying and investigating factors impacting cost of risk, one might be surprised by how quickly the factors add up. As the factors affecting cost of risk are identified, an institution can move forward and explore how to control these various factors and their costs more effectively.

From a conceptual perspective, insurance premiums are our anticipated losses plus the insurer’s expenses. However, it has been shown that the biggest slice of an insurance premium is losses and the insurance industry’s perception of our losses. Perception is often stronger than reality, and in the long run:

• The lower UC’s losses and the more positive the insurance industry’s perception of UC’s risk of incurring losses (i.e. risk exposures), the lower the insurance premiums will be; and,

• The lower UC’s insurance premiums, the lower UC’s total cost of risk will be.

Thus, the institution is best served when its losses are under control and when the insurance industry sees it as having its risk exposures under control, having strong and effective safety and loss control programs, and being able to handle any loss it does sustain in an efficient manner. In this sense, total cost of risk includes the following:

+ + = Total Cost of Risk

Premiums Retained Losses Administrative Expenses

It is beyond the scope of this program to attempt to quantify or take into account intangible costs, such as the impact of risk adversities or strategic decisions on reputations, donations, admissions applications, or other “soft costs.” Although quantifying the cost of reputational risk is challenging, it is one of the largest risks facing higher education institutions.

UC AND EDUCATION INDUSTRY TOTAL COST OF RISKTo evaluate the success of our risk financing and loss control programs it is essential to benchmark the university’s TCOR against other institutions in the education industry. As of 2014, the most recent year for which we have compiled industry data, the average TCOR increased for the education industry (which includes K-12 as well as for-profit institutions) for the third year in a row. More problematically, the 10% average increase in 2014 was on top of a 7% increase in 2012 and a 3% increase of the TCOR in 2013. Among fourteen industries tracked, the education industry had the sixth highest average TCOR . The upward trend can be attributed to material increases in property, liability, workers’ compensation, management liability and medical malpractice costs. Noteworthy metrics and findings are:

• UC’s Total Cost of Risk for FY15 was $4,424,209 (see Figure 5). Total Cost of Risk per $1,000 of operating revenues was $5.67, which compares favorably to 2015 RIMS Benchmark Survey of $6.45.


• UC incurred $508,168 in claims’ costs and premium solely for general liability claims in FY15. UC’s cost of risk for general liability claims was $0.65 per $1,000 of operating revenues, which is unfavorable when compared to the industry average of $0.46 per $1,000 of revenues for all educational institutions reporting.

• When considering total property costs, UC’s cost of risk was $2.00 per $1,000 of operating revenue, and $1.34 per $1,000 for total revenues (operating and non-operating). This compares unfavorably to the industry average of $1.38 for all educational institutions reporting.

• For Educator’s Legal Liability, UC’s cost of risk is $0.28 per $1,000 of revenues, which compares favorably to the industry average cost of risk of $0.48 per $1,000 of revenue.

• UC’s FY15 cost of risk for auto liability and auto property damage combined is $0.07 per $1,000 of revenues. This is on par with our industry benchmark cost of risk of $0.06.

• UC’s FY15 Enterprise Risk Management department costs, including employee compensation, total $787,785, or $1.01 per $1,000 of operating revenues, which compares favorably to the industry average of $1.32 (see Figure 6). It should be noted that the department costs for risk management were offset by $199,002 of revenues generated for the provision of risk management services provided to UC Health in FY15. Taking that into account, UC Department of Enterprise Risk Management costs total $588,782, or just $0.75 per $1,000 of operating revenue, and compares even more favorably to industry cost of $1.32.

Figure 5: FY15 TCOR – Risk Financing

UC Total Cost of RiskFY15 = $4.42 million

Workers’ Compensation, $584,308

Property, $1,564,438Auto, $72,200

General Liability, $508,168

Educator’s Legal Liability, $215,588

Cyber, $116,668

Medical Malpractice, $51,414Executive Protection, $18,463

Other Liability, $7,050Non-Owned Aircraft, $21,750

Crime, $20,079Internal/External Expenses, $1,244,083


Figure 7: Industry TCOR vs UC FY15 – Other Related Data and Metrics

FY15 Total Operating Revenues

Total UC Cost of Risk

Total cost of risk/$1000 Revenues

UC Worker’s Compensation (WC) Premium

Employees1 WC cost/employee

UC WC cost of risk/$1000

revenues2

$781,588,000 $4,424,209 $5.67 $584,308 $10,569 $5.29 $0.75

Property cost of risk with claims

Property cost of risk without claims

Total Insured Values (TIV)

Property Cost/$100 TIV with claims

Property Cost/$100 TIV without claims

$1,564,438 $993,394 $4,722,223,961 $0.033 $0.021

1Employee count as reported to 2012 Ohio Board of Regents2Compares very favorably to average industry cost of $1.80 as reported in the 2015 RIMS Benchmark Survey

Loss History/ClaimsLoss history data is central to forecasting the ultimate value of claims and determining how future losses might be prevented. It is also a key component in determining the university’s total cost of risk and it provides a basis to evaluate the success of our risk management and loss control efforts. Efficient claims’ management can lower the amount of losses and minimize disruption to the university’s mission. The tables and charts below (see Figures 8-11) provide greater detail about UC’s automobile and property claim trends over the past three years. Going forward, more specific data will be compiled and reported for our General Liability and Educator’s Legal Liability claims. Baseline data for these areas indicate the following:

• UC incurred a total of $149,058 in General Liability claims/losses in FY15.

• UC incurred a total of $159,950 in Educator’s Legal Liability (D&O) claims/losses in FY15.

Figure 6: FY15 TCOR – Administration Costs

Internal/External Expenses

Risk Management Employee Compensation, $710,198

Director’s Budget, $27,869

Actuarial Services, $58,702

External Legal Counsel, $194,787

Loss Control, $47,937

Risk Management Consulting, $4,264

Third Party Administration, $63,346

Broker Fees for Specialized Services, $51,029.13

Other, $44,237

Travel, $33,350

Other, $8,364


Figure 8: Auto and Property Claims – Three Year Loss History

Auto Liability & Auto Physical Damage (Combined)

Year Claim Count UC Paid Expense Reserve Total Incurred1

FY13 65 $19,624 $600 $ 20,000 $40,224

FY14 65 16,035 1,554 8,000 25,589

FY15 76 19,377 13,610 2,500 35,487

Totals 206 $55,036 $15,764 $ 30,500 $101,3001Additional claim amounts incurred and paid by insurance sources for FY13, FY14, and FY15 are $74,780, $73,179 and $24,411, respectively.

Property

Year Claim Count UC Paid Loss Penalty Payments1 Reserve Total Incurred2

FY13 22 $313,929 $35,048 $0 $348,977

FY14 19 265,092 51,476 0 316,568

FY15 39 495,804 75,241 331,741 902,785

Totals 80 $1,074,825 $161,765 $ 331,741 $1,568,330

1Members having a claim in the IUC-IC pool layer must repay 30% of pool loss over 3 years. The penalty is based on loss amount between $100,000 to $350,000 and the maximum penalty for each claim is $75,000, paid back at $25,000/year.2Additional claim amounts incurred and paid by insurance sources for FY13, FY14 and FY15 are $329,022, $346,405 and $62,921, respectively.

Figure 9: Auto and Property Claims – Three Year Claim Count

80

60

40

20

0

# of

cla

ims

Fiscal Year

65 6576

FY13 FY14 FY15

80

60

40

20

0

# of

cla

ims

Fiscal Year

22 19

39

FY13 FY14 FY15

• The total number of auto claims was consistent from FY13 and FY14, but UC experienced a 16.9% increase in the number of reported auto claims from FY14 to FY15.

• There was a 105% increase in the number of reported property claims from FY14 to FY15.

AUTO CLAIMS PROPERTY CLAIMS


Figure 10: Auto Claims – Three-Year Loss History

AUTO LIABILITY / PHYSICAL DAMAGEFY13-FY15

$45,000

$40,000

$35,000

$30,000

$25,000

$20,000

$15,000

$10,000

$5,000

$0

$40,224

$25,589

$35,487

FY13 FY14 FY15Fiscal Year

$ am

ount Reserve

Expense

UC Paid

• The average annual cost of automobile claims, when including any amounts paid by insurance, decreased by 31.1%, from a high of $115,003 in FY13 to $59,974 in FY15.

• At the same time, average annual claim expenses increased substantially, by 467.4%, from $600 in FY13 to $13,610 in FY15. This is largely due to a change in the third party administrator responsible for handling claims for the IUC-IC. Enterprise Risk Management is exploring opportunities to reduce this expense.

Figure 11: Property Claims – Three-Year Loss History

PROPERTYFY13-FY15

$1,000,000

$900,000

$800,000

$700,000

$600,000

$500,000

$400,000

$300,000

$200,000

$100,000

$0

$348,977$316,568

$902,785

FY13 FY14 FY15Fiscal Year

$ am

ount Reserve

Loss Penalty

UC Paid

• Average cost per property claim has decreased 29%, from $32,184 in FY14, to $22,832 in FY15.

• The university experienced a 105% increase in the number of property claims filed between FY14 and FY15, from 19 to 39.

• UC experienced three large property losses in FY15. This includes a water damage loss caused by a pipe failure, and two critical research freezer losses totaling in excess of $500,000 combined. (Note: a third research freezer loss was incurred in FY16 and is reserved at $770,000).


UC’s Enterprise Risk Management (ERM) program is spearheaded by the chief risk officer in partnership with Internal Audit and engages key leadership as well as the UC Board of Trustees (see Figure 12). It is essential to have engagement, however, from all levels of the university to fully implement a robust ERM program.

Figure 12: UC’s ERM Governance Structure

Audit & Risk Management Committee of the Board

ERM Executive Committee (PEC+)

ERM Risk Council

Communications

Risk Review

Subcommittees:

ERM is a discipline that attempts to manage all institutional risks. An institutional risk is defined by the International Standards Organization (“ISO”) under ISO31000, as “any issue that impacts an organization’s ability to meet its objectives.” This definition is intentionally broad and it should be noted that for the purposes of this report and UC’s ERM program, “risk” includes both adverse impact as well as opportunities (see Figure 13 for ISO 31000 Risk Management Process).

Traditionally, Enterprise Risk Management focused on the transfer of risk through a robust insurance program and related loss control measures. In recent years, universities have recognized that a holistic strategy, similar to modern corporate approaches, enables improved strategic planning and long-term success. A successful ERM program and framework is designed to optimize the benefits of risk and minimize their costs. The emphasis of the university’s ERM program is to ensure that decisions that trade value and risk will be made on an informed basis, will be aligned with the university’s risk tolerance and strategy, and will provide greater transparency to the board. Through the leadership and partnership between the university’s chief risk officer and director of internal audit, along with several faculty and staff members who serve on the Risk Council, good progress has been made in these respective areas over the past year or so.

UC’s senior leadership has adopted this model and is fully engaged in the process of ERM, which includes:

• Identifying risks across the enterprise (current and emerging)

• Assessing the impact of risks to the operations and mission

• Assigning accountable owners to develop mitigation plans for the top risks

• Monitoring the effectiveness of our actions in reducing the risks and advancing our mission

ENTERPRISE RISK MANAGEMENT


Figure 13: ISO 31000 Risk Management Process

The department has undertaken a broad range of interviews, including discussions and input from more than 100 stakeholders across the campus, and with key external partners. The result of the baseline risk assessment yielded the following enterprise-wide index of top risks and opportunities at 12/31/15:

Figure 14: Top 10 Enterprise-wide Risk (red) and Opportunities (green) Index

Conduct Policies/Judicial Procedures 19 Increase Research Initiatives 17

Policing 21 Grow Enrollment via E-Learning 18

Title IX/VAWA Compliance 24 Partner with Corporate Entities 18

Diversity & Inclusion 19 Diversity & Inclusion into Hiring 16

Communication 19 Explore New Revenue Streams 16

Crime 18 Conduct Wider Marketing Efforts 16

Financial 18 Develop Community Engagement 16

Crime Reporting 18 Out-of-state Recruitment 15

Athletics Funding Model 17 Focus On Inclusion 15

Alcohol/Substance Abuse 17 Improve Talent Acquisition 15

The next critical step in the ERM program involves engaging with appropriate operational and cabinet level risk owners to evaluate each of the identified areas. Various risk committees, up to and including standing committees of the UC Board of Trustees, will hear from the operational owners of certain risk areas. These operational owners will share and discuss any current controls, mitigation plans and activities, and related key metrics, to be continued or implemented over the next 12 to 18 months.

Of particular note, in FY15 the UC Foundation launched a separate in-depth ERM approach and framework for their organization. UC’s chief risk officer has partnered with the leadership team at UC Foundation to provide them with ongoing consultation services and support as they fully implement their ERM program.

Establishing the context(5.3)

Com

mun

icat

ion

and

con

sult

atio

n (5

.2)

Mon

itor

ing

and

rev

iew

(5.6

)

Risk treatment(5.5)

Risk identification (5.4.2)

Risk analysis (5.4.3)

Risk evaluation (5.4.4)

Risk assessment (5.4)

Mandate and commitment (4.2)

Monitoring and review of the

framework (4.5)

Design of framework for managing risk

(4.3)

Implementing risk management

(4.4)

Continual improvement on the framework

(4.6)

a) Creates value

b) Integral part of organizational processes

c) Part of decision making

d) Systematic, structured and timely

e) Explicitly addresses uncertainty

f) Based on the best available information

g) Tailored

h) Takes human and cultural factors into account

i) Transparent and inclusive

j) Dynamic, iterative and responsive to change

k) Facilitates continual improvement and enhancement of the organization


Training/WorkshopsEnterprise Risk Management is dynamic, iterative and responsive to change. It supports the university and its mission. As part of this effort, we sought to increase our engagement with internal stakeholders. To that end, we were pleased to host an in-depth seminar on Special Events and the risk and insurance issues that accompany such important occasions. We also addressed issues such as liability in athletic camps, research freezer losses and were proud to host URMIA’s “Risky Business Week,” which touched on many of the most challenging issues confronting universities today. In FY15, the Department of Enterprise Risk Management provided nearly 900 man-hours of training on multiple topics to hundreds of individuals.

Student, Faculty & Staff ServicesWith more than 10,000 faculty and staff, 45,000 students, and over 400 registered student organizations at the university, UC has a vibrant and dynamic academic and learning community. In this environment, the Department of Enterprise Risk Management seeks to assist organizations and stakeholders from all parts of the university to identify and mitigate risks that would interfere with the student and work experience. Some of our collaborations for FY15 are listed here:

• With Intramural athletics, evaluated the site and plans for the First Annual Intramural Crosstown shoot basketball tournament at Xavier University.

• During the MLB All-Star festivities, worked with Athletics to review plans involving the MLB Fantasy Camp at Schott Field.

• Worked with Athletics to plan safety and loss control measures for the special entertainment activities at the Crosstown Shootout game (see Bearcat Mascot photo).

• Consulted and collaborated with the Center for Community Engagement on loss control considerations for “UC Serves” 2015.

• Considered safety, risk, and insurance requirements with CECH Advancement and Transition Services programs, as well as with UC Inte-grative Medicine’s “Resolve to Get Healthy” community day.

• Provided active participation and risk management services, as needed and appropriate, for various university and UC Health committees, includ-ing the following, as example: Travel Oversight Committee, International Working Group, Financial Policy Development Committee, Threat Assess-ment Group, Athletics Mental Health Committee, Healthcare Strategy, and Patient Relations Committee.

Fleet SafetyThe University of Cincinnati owns and operates a fleet of over 300 vehicles ranging from police cruisers to box trucks to passenger vans. Due to the number and variety of motor vehicles in use, safety is a top priority. Working with Transportation, Environmental Health & Safety (EH&S), and other key stakeholders, the university has established a fleet safety program to provide information and guidelines to employees, students and volunteers regarding responsibilities for the safe operation of university-insured vehicles.

A key component of this program is the Motor Vehicle Accident Review Committee. This committee, which includes members from Enterprise Risk Management, Transportation Services, Facilities Management, EH&S, Public Safety and Athletics, meets quarterly to review and evaluate accidents involving university-insured vehicles, and to monitor and implement loss control measures. The goal of the committee is to prevent future accidents by educating drivers and analyzing accident information and loss trends. Drivers involved in an accident are required to attend. Increased discussions have led to the greater use of the on-line Defensive Driving course available through EH&S, new technology such as back-up cameras, and restrictions on the use of certain higher-risk vehicles such as 15-passenger vans.

Another component of our Fleet Safety program is the use of preferred vendors, such as Enterprise Rent-A-Car and National Car Rental. As part of our engagement with the IUC-IC, our contract with these vendors includes discounted

LOSS CONTROL


base rates and favorable coverage terms and conditions for bodily injury and property damage claims. In the event of an accident that occurs with the use of these contracted vehicles, the vendor’s liability insurance responds and pays the first $1,000,000 in damages.

In FY15, the Department of Enterprise Risk Management was allocated $6,500 to implement the driver’s record retrieval program, which is an extension of our Fleet Safety initiatives. Currently the Motor Vehicle Safety Committee checks driving records for validity after an accident has occurred. With this additional support and funding from university administration, we will seek to reduce potential losses by obtaining driving records annually for employees who drive university vehicles as part of their primary job.

Critical Research FreezersOver the past 18 months or so, the university has experienced several major research freezer losses, resulting in property claims totaling an estimated $1.2 million. (This data includes a substantial claim incurred in FY16.) The university’s insur-ance carries a $100,000 per claim deductible. Each claim is further subject to an additional loss penalty passed through from the Inter-University Consortium Insurance Council (IUC-IC), of up to $75,000. These types of claims in particular cre-ate adverse impact on UC’s status within the IUC-IC, making UC a greater risk to the pool of state universities. To mitigate the impact of these losses, the Department of Enterprise Risk Management is collaborating with the Office of Sponsored Research to develop a research freezer program. Risk management plans for loss control in this area are designed to protect critical research by addressing the areas of freezer alarms, greater collaboration with appropriate departments on procurement of research freezers which meet a certain standard, and shared financing of loss deductibles with the departments experiencing such losses who have opted not to participate in the loss control program.

Special EventsRecognizing the risks associated with university-sponsored or hosted events, we conducted a first-time seminar to edu-cate university stakeholders, highlighting the goals of special events, common hazards, the importance of planning and risk control. Additionally, we have created a webpage dedicated to the topic of Special Events for internal and external stakeholders. This webpage provides external stakeholders access to platforms allowing for the purchase of third-party special event insurance coverages for on-campus events. A web-based training and informational module for stakehold-ers seeking additional information on managing the risk of special events will also be available in FY16.

Data Breach On December 9, 2015 the university held a Cyber Liability and Breach Response Workshop, including a tabletop exercise. This workshop was cohosted by UC Department of Enterprise Risk Management, UC Privacy Office and UC Office of Information Security, and facilitated by Beazley, UC’s cyber legal liability insurance carrier. Its focus was on assessing the impact of a data breach and cyber incident on the university’s critical systems, data or mission, and evaluating UC’s response capabilities. Several departments and affiliates participated in this important exercise, including the Provost’s Office, Internal Audit, Human Resources, UC Health, UC Foundation, and others.

Risky Business WeekThe university participated in its first annual URMIA “Risky Business Week”, which involves a week aimed at forging stronger campus relationships and raising awareness of how good risk management practices in many diverse areas can advance UC in the pursuit of its academic, social, and economic mission and goals. Many campus participants attended the various lunch and learn sessions. The topics covered a broad range of risks universities face, including:

• Managing Risks with Student Groups

• Mitigating Travel Risks with University Policies and Procedures

• Can It Begin with Me? Risk Leadership on Campus

• Lab Risks: The Role of Risk Assessment within the Risk Management Paradigm

• Data Breach 201


While the milestones and accomplishments of the last year are notable, the work of implementing a robust Enterprise Risk Management program at UC will be an ongoing, evolutionary process. The next year should bring an even more structured approach and meaningful dialogue about risk at every level of the institution. The intent is to focus on the risks and opportunities with the biggest potential impact and to facilitate greater collaboration among all stakeholders to ensure sustainable solutions are in place. The Department of Enterprise Risk Management looks forward to leading this charge and partnering with all colleges, departments, and units to make UC’s ERM program a best-in-class model for other institutions to benchmark. The Riskonnect implementation and the plan to measure UC’s level of risk maturity are key projects to help achieve this goal.

RiskonnectBeginning in FY15, the Department of Enterprise Risk Management began the process of identifying and selecting a risk management, governance, and compliance software partner. Our vendor of choice, Riskonnect, provides a web-based platform that integrates incident/claims, insurance, property and other exposure data, litigation, and enterprise risk management features. The technology will allow the department to consolidate claim, financial, insurance policy, and risk exposure data into a single authoritative source for our use and the use of other departments within the university. We anticipate that the risk management information system and governance and regulatory compliance software will empower the university and generate cost savings by transforming risk data into actionable intelligence and provide guidance in the application of loss control resources. Moreover, it will promote collaboration and departmental efficiencies and will help us identify the best ways to steward the university’s resources and further its mission.

Risk Management Procedures ManualWe also look forward to further enhancing our efficiency and responsiveness by developing a Risk Management Procedures Manual. We anticipate that the manual will prove to be a valuable resource as it will communicate ideas and clarify practices that were previously contained in numerous letters and memos, stated verbally, or contained in outdated manuals. By including appropriate procedures, we, as a Department, will be better informed and provide enhanced responsiveness to our stakeholders. This Manual will cover topics such as:

• Claims’ identification, evaluation and reserving

• Use of actuarial services

• Selection of outside counsel

• Purchase of insurance

Risk Maturity Model (RMM)Maturity models are a recognized measurement concept for demonstrating development progress of Enterprise Risk Management programs and for highlighting consistent outcomes across the organization. Since 2006, the Risk & Insurance Management Society (RIMS) Risk Maturity Model for ERM has been a best-practice requirements model used by executives and others charged with risk-related responsibilities. The model helps to design sustainable ERM programs and infrastructure by reflecting the organization’s strategy and short-, mid- and long-term business objectives. The RMM also evaluates the effectiveness and efficiency of an existing ERM program and serves as an important educational, planning and measurement resource for boards of directors, executive officers, and chief audit executives.

Within the RMM, organizations are placed on the maturity scale from an informal “ad hoc” level to a fully realized “leadership” capability level. To enable University of Cincinnati to understand and benchmark where it fits within the RIMS Maturity Model, at the conclusion of FY16 we will compute the baseline measurement score for the university, utilizing the RIMS seven core attributes that describe the fundamental characteristics of an effective ERM process:

1. ERM-based approach characterized by executive support within the organization’s culture;

2. ERM process management characterized by integration into business processes;

3. Risk-appetite management characterized by accountability within leadership and policy to guide decision making;

A LOOK AHEAD


4. Root-cause discipline characterized by linking outcomes with their sources;

5. Uncovering risks characterized by analyzing and documenting risks and associated uncertainties in considering threats and opportunities;

6. Performance management characterized by executing vision, mission and strategy utilizing risk management methods; and,

7. Business resiliency and sustainability characterized by integration into operational planning and execution.

Going forward, the RMM score will be used to benchmark against other ERM programs. More importantly, we will use our baseline scores to measure against future progress and success.

Faculty/Staff 911 GuideComing spring 2016, the Faculty/Staff 911 Guide is a collaborative effort between the Office of the Provost, Public Safety, University Health Services, Student Affairs, Counseling and Psychological Services, and the Department of Enterprise Risk Management. This folder was designed with the safety of the UC community in mind. It is a compilation of the many campus and community resources available if ever faced with an emergent or sensitive situation involving students, or even colleagues. At a high level, the Faculty/Staff 911 Guide contains:

• Tips for identifying and talking to a student of concern

• A comprehensive listing of resources available to help in various types of situations

• The immediate actions to take in case of an emergency

Enterprise Risk Management WebsiteOne of our key goals for 2016 is to enhance our partnerships and demonstrate the value we bring to the university. To that end, our web pages are being updated with more relevant information about our top issues, answers to our most commonly asked questions, and access to a myriad of other resources. Some of the new topics include:

• Introduction to ERM

• How to Conduct a Risk Assessment

• Protecting Minors on Campus

• UC’s Fleet Safety Program

In an effort to better serve the university’s needs, the pages will be dynamic and based on the input of colleagues around campus. Many pages are already being updated. Stay tuned for full launch by summer 2016!


CONTACT US Thank you again for taking the time to read this publication. We welcome your feedback and encourage you to reach out to us with any risk management concerns or issues in the year ahead!

Department of Enterprise Risk ManagementP.O. Box 670785Cincinnati, OH 45267-0785

Phone: 513-584-5042Fax: 513-584-5559Email: [email protected]

To learn more, visit our website: uc.edu/gencounsel/rmi

http://uc.edu/gencounsel/rmi


Documents

2015 STEWARDSHIP REPORT - University of Cincinnati€¦ · 2015 STEWARDSHIP REPORT Issue Date: March 2016 To learn more, visit: uc.edu/gencounsel/rmi Department of Enterprise Risk